TP-Link TL-SG108E HTTP GET Request usr_account_set.cgi get request method with sensitive query strings

Vulnerability

The vulnerability resides in the /usr_account_set.cgi endpoint of TP-Link TL-SG108E switch firmware version 1.0.0 Build 20201208 Rel. 40304. The handler transmits the username and password arguments via a GET request, exposing sensitive credentials in the URL. This affects the unknown function of the HTTP GET Request Handler [1][2].

Exploitation

An attacker can exploit this remotely by intercepting network traffic, accessing browser history, or analyzing server logs where the GET request with credentials is stored. The attack complexity is high, but exploitation is considered difficult [1][2].

Impact

Successful exploitation leads to disclosure of credentials (username and password), compromising the confidentiality of the switch's account credentials. This could allow unauthorized access to the device's management interface [1][2].

Mitigation

Upgrading to version 1.0.0 Build 20250124 Rel. 54920(Beta) addresses the issue. The vendor provided a pre-fix version. For a permanent fix, the application should use POST instead of GET for transmitting sensitive data [1][2].